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(57) L'invcntion est une methode de d&eclion des 
fVaudes dans un systems de communication sans fiL Lors 
d'un premier acces au systemc realise au moyen d*un 
compte d' abound, le systeme stocke des donnees 
d 'identification de ce premier acces dans une base de 
donnees. Lors d*uu second acces au moyen du meme 
compte d'abonne, ie systeme extrait les donnees stockees 
qui pcrmetlent d'identifier le premier acces et transmet 
au moins une partie des donnas extraites au dispositif 
sans fil utilise pour le second acces. L^itihsateur du 
dispositif examine ces donnees, determine si le premier 
acces itait autorisc ct transmet mi systemc une reponse 
indiquant si le premier acces etait fraudulcux. Si cette 
reponse indique que le premier acces etait peul-clre 
fjauduleux, le foumisseur de services sans fH peut alors 
prendre les mesures qui s'imposent. 



(57) A method for detecting fraud in a wireless' 
communication system. lairing a first access to the 
system using a subscriber account, the system stores data 
identifying the first access in a database. During a second 
subsequent access lo the system using the same 
subscriber account, the system retrieves the stored data 
identifying the first access and transmits at least a portion 
of the retrieved data to the wireless device used for the 
second access. The user of ihe device reviews the data, 
determines whether the first access was authorized, and 
sends a response to the system indicative of whether the 
first access was fraudulent. If the response indicates that 
the first access may have been fraudulent, the wireless 
service provider may take appropriate action. 
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USER ASSISTED WIRELESS FRAUD DETECTION 

A method for detecting fraud in a wireless communication system. During a first 
access to the system using a subscriber account, the system stores data identifying tie 
5 first access in a database. During a second subsequent access to the system using the 
same subscriber account, the system retrieves the stored data identifying the first access 
and transmits at least a portion of the retrieved data lo the wireless device used for the 
second access. The user of the device reviews the data, determines whether the first 
access was authorized, and sends a response to the system indicative of whether the first 
1 0 access was fraudulent. If the response indicates that the first access may have been 
fraudulent, the wireless service provider may take appropriate action. 
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USER ASSISTED WIRELESS FRAUD DETECTION 

Field of the Invention 

This invention relates generally to wireless fraud detection and more particularly 

S to a method for user assisted wiretes fraud detection. 

Background of the Invention 

The unauthorized and/or illegal use of a wireless telephone or a wireless 
communication nerwork (i.e. fraud) is a major problem in the wireless telephone industry. 

1 0 Worldwide losses due to fraud are in billions of dollars per year. 

Generally, a wireless telephone is identified by an electronic serial number (ESN) 
and a mobile identification number (MIN). This ESN/MTN pair uniquely identifies every 
wireless telephone. When accessing a wireless communication network, the telephone 
sends its ESN/MIN pair to the communication network, which then provides service to 

1 5 the telephone if the ESN/MIN pair corresponds to an authorized subscriber account 
One fraud technique is cloning, in which a second, or clone, telephone is 
programmed with the same ESN/MIN pair of an authorized telephone. The network 
recognizes the cloned telephone as an authorized telephone, and allows the cloned 
telephone 1 to access the network. Valid ESN/MIN pairs, for use in cloned telephones, 

r.O may be obtained in several ways. One way is by reading these values from an authorized 
telephone. Another way is through the use of eavesdropping equipment which reads the 
ESN/MIN pairs of authorized telephones being transmitted over the air Interface during 
use of an authorized telephone. Many cloned telephones having the same ESN/MIN pan- 
can be produced resulting in a large amount of fraudulent use in a relatively short time 

25 period. 

There are two ways to deal with fraud. The first is fraud prevention, which is 
aimed at preventing fraud before it happens. The other is fraud detection, which is aimed 
at detecting, and stopping, fraud which has already occurred. Fraud prevention is the 
preferred technique because it stops fraud before losses are incurred. Various techniques 
30 are currently used for fraud prevention. For example, requiring the use of a personal 
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identification number (PfN) before access to the network is allowed. This technique is 
losing its effectiveness since the eavesdropping equipment is capable of reading PINs 
transmitted over the air interface. Another technique for fraud prevention is voice 
verification, where the network engages the telephone user in a voice verification process 
5 to validate the particular user. This technique is not widely used because of the 

limitations of voice recognition technology. Another fraud prevention technique is Rf 
fingerprinting, wherein the radio frequency transmission characteristics of an authorized 
mobile telephone with a particular MIN are stared in a database. When a telephone 
attempts to access the system using the particular MIN, the radio frequency transmission 

1 0 characteristics of the telephone are compared against the radio frequency transmission 
characteristics stored in the database. If the transmission characteristics differ 
significantly then the mobile telephone may be identified as fraudulent. Most recently, 
the technique of authentication is the preferred method of fraud prevention. This is a 
sophisticated technique in which the network engages the telephone in a challenge- 

1 5 response process whereby the network can verify that the particular telephone is authorize 
to access (he network. Eavesdropping equipment cannot detect any useful information by 
reading information from the air interface during authentication. 

Although authentication promises to be an effective tool against wireless fraud, 
history shows that fraudsters have been able to keep Op with technology and will 

20 eventually be able to clone telephones which are protected using the authentication 
scheme. This leads to the conclusion that no matter how sophisticated the fraud 
prevention scheme, fraud detection techniques will always be needed as well. 

One type of fraud detection technique is a profiling system, in which the 
communication system stores user profiles in the system. These user profiles contain 

25 information on the type of usage generally made by a particular telephone. For example, 
a particular telephone profile may indicate that the telephone is generally used between 
the hours of Sam and 8pm f Monday through Friday, and is generally used to call 
telephone numbers within the United Slates. If the communication system detects a call 
being made with that telephone's ESN/MIN pair at 2am on a Saturday night to a 

30 telephone number in South America, ihe communication system may flag that call as 
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suspicious. The communication service provider may then follow up and investigate the 
call. Another type of fraud detection is velocity checking where sequential calls are 
analy2ed to determine if a single phone could have made the calls. For example, if the 
communication system handles a call for a telephone located in Seattle, Washington at 

5 9am, and then handles a call for a telephone with the same ESN/MIN pair at 9:02am in 

Spokane, Washington, the communication system recogni2es that a single telephone 
could not have been used for both calls and the system may flag die call as suspicious and 
the communication service provider may then follow up and investigate the call. 

These fraud detection schemes are limited in that they can only detect certain type 
10 of fraudulent use of cloned telephones. What is needed is a more effective fraud 
detection technique. 

Summary of the Invention 

In accordance with the present invention! data identifying a first wireless access 

1 5 using a subscriber account is stored in a database. During a second subsequent wireless 
access using the same subscriber account, the stored data identifying die first access is 
transmitted to the wireless device. In this way, the subscriber can review the data and 
determine whether the prior access was authorized. In addition, the subscriber may 
respond 16 the information by sending back to the service provider information indicative 

20 of whether the first access was authorized, 

: In a particular embodiment, the wireless telephone system stores call detail data 
identifying a first telephone call which uses a subscriber telephone account During a 
second subsequent telephone call using the same subscriber account, the system retrieves 
the stored call detail data identifying the prior telephone call, and transmits at least a 

25 portion of the call detail data to the wireless device being used during the second call. In 
various embodiments, the call detail is transmitted as a text message or as a voice 
message. The subscriber reviews this call detail data to determine whether the prior call 
was authorized and sends a response back to the wireless telephone system. If the 
response indicates that the prior call may be fraudulent, the wireless service provider can 

30 take appropriate action. 
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These and other advantages of the invention will be apparent to those of 
ordinary skill in the art by reference to the following detailed description and the 
accompanying drawings. 

S Brief Description of the Drawings 

Fig. I shows a wireless communication network in which the present invention 
may be implemented. 

Fig. 2 shows the format of a call detail record table. 

Fig. 3 is a flowchart of the steps performed by the MSC during mobile telephone 
1 0 call origination in accordance with the present invention. 

Fig. 4 is a flowchart of the steps performed by the MSC during mobile telephone 
call termination in accordance with the present invention. 

Figs. 5-8 show exemplary contents of the call detail record table in conjunction 
with an example of how fraud may be detected in conjunction with the aspects of the 
15 present invention 



Detailed Description 

The present invention may be implemented in a wireless communication network, 
such as network 100 shown in Fig. 1. Wireless communication network 100 comprises a 

20 basestation (BS) 1 14 connected to a mobile switching center(MSC) 1 10. The MSC 1 10 
is further connected to a call detail record (CDR) database (DB) 126. The MSC 1 10 
connects the wireless communication network 100 to the public switched telephone 
network (PSTN) 120 via communication link 124. As is well known, wireless 
communication networks, such as network 100, generally contain a plurality of base 

25 stations, each of which communicates with mobile stations within the geographic serving 
area (cell) of me base station. The geographic area of all cells taken together is the 
coverage area of the wireless communication network. The cell within which a mobile 
station is operating is called the serving cell, and the base station within the serving cell is 
called the serving base station. Each base station is connected to, and controlled by, an 
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MSC. The MSC which is connected to the serving BS is the serving MSG. Depending 
on the architecture, a wireless communication network may have more than one MSC, 
with each MSC controlling a plurality of BSs. The MSC connects the wireless 
communication network to other networks, such as the PSTN, other wireless networks, 
5 and other data networks (e.g. Internet). 

For case of illustration, Fig. i shows one MSC 1 10 connected to one BS 1 14. As 
shown in Fig. I, a mobile telephone 1 16 is communicating with serving BS 1 14 via a 
wireless communication channel 1 1 8, The protocol of the wireless communication 
chann el 1 18 may be, for example, the air interface described by TIA/EIA Interim 

10 Standard IS- 136 J t 800 MHz TDMA Communication - Radio Interface - Mobile Station - 
Base Station Compatibility - Digital Control Channel, December 1994, 
Telecommunications Industry Association (hereinafter "IS-136"), which is incorporated 
herein by reference. Of course, the principles of the present invention are not limited to 
use in systems which operate in accordance with any particular wireless protocol The 

1 5 principles of the present invention may be applied to any type of wireless system (e.g. 
code division multiple access (CDMA), satellite, global system for mobile 
communications (groupe speciale mobile) (GSM), advanced mobile phone service, 
(AMPS), fixed wireless). One skilled in the art could readily apply the teachings herein 
to other wireless systems. 

20 As is well known, the MSC 1 10 is an intelligent switching device and contains a 

processor 128 connected to memory 130. Memory 130 contains computer program 
instructions which are executed by the processor 12S which control the operation of the 
MSC 1 10 in accordance with the method of the present invention. The memory 130 may 
be a RAM, ROM, magnetic disk, optical disk, or other type of computer storage medium. 

25 Further, memory 130 may be some combination of such computer storage media. The 
MSC also comprises an interactive voice response (IVR) unit 132 which is used to 
generate voice messages to mobile telephones and for receiving signals (voice or DTMF) 
from mobile telephones. In other embodiments the IVR 132 could be implemented as a 
stand alone piece of equipment appropriately connected to the MSC 1 1 0. MSC 1 10 may 

30 also contain other components for carrying out otlver furictions of the MSC (e.g. routing) 
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but such other components are not described herein and would be well known to one 
skilled in the art. Although the functions of MSC 110 have been described herein as 
being controlled by processor 1 28 executing stored computer program instruction, it is to 
be understood that such functions could also be carried out by hardware, or a combination 
5 of software and hardware. 

The CDR DB 126 stores call detail informarion for all of the mobile telephones 

which have wireless communication network 100 as their home system. As is well 

i 

known, mobile telephones are each assigned to a home network, which is the network in 
which the telephone normally operates. The home network also stores subscriber profile 

10 and other information about the mobile telephone. Thus, for each telephone which has 
network 100 as Its home network, the CDR DB 126 stores call detail information for the 
last call in which the telephone engaged in a CDR table. The format of the CDR table 
200 is shown in Fig. 2. 

The table 200 contains columns 202*220 which contain informauon on the MIN 

1 5 of the telephone (202), the ESN of the telephone (204), the date of the last call (206), 
whether the last call was incoming or outgoing (208), the start time of the last call (210), 
the end time of the last call (212), the originating telephone number of the last call (214), 
the location of the originating telephone (2 1 6), the destination telephone number of the 
last call (218), and the location of the destination telephone (220). For each mobile 

20 telephone which has network 100 as its home network, a record will be stored in table 
200., 

The records in table 200 are created and updated by the MSC 1 10 as it handles 
calls for each of the mobile telephones. All of the information to be entered in the 
records can be determined by the MSC 1 10 in a well known manner. The MSC 110 
25 knows the MIN and ESN of all mobile telephones which are active in the network 100. 
The MSC 1 10 can determine whether a particular call was placed by a particular mobile 
telephone (outgoing), or whether a call was placed to a particular mobile telephone 
(incoming). The MSC 1 10 has an internal clock which allows it to determine the start 
and end time of the call. 



Received Jan-16-03 1 0 :36am From-416 862 7661 To-Greenberg Traurig CH Page 024 



a Q2236086 1998-04-27 



7 . 

If the mobile telephone placed die call, then the originating telephone number is 
the MIN of the mobile telephone. The originating location can be determined by the 
MSC 1 10 determining which base station the mobile telephone was communicating with 
when the call was placed and looking up the location of that base station in an internal 

5 lookup table. The destination number consists of the digits dialed by the mobile 

telephone and transmitted to the MSC 1 10 when the mobile telephone initiated the call 
The destination location can be detemained by the MSC 1 10 performing a lookup to an 
internal location table using the area code and three digit exchange of the dialed number. 
If the destination telephone is a mobile telephone, then the entry in column 220 of table 

10 200 may contain ''mobile". 

If the call was an incoming call to the mobile telephone, then the originating 
number is the telephone number of the telephone calling the mobile telephone. This 
telephone number can be determined in a well known maimer using automatic number 
identification (ANI). The originating location can be determined by the MSC 1 10 

1 5 performing a lookup to an internal location table using the area code and three digit 
exchange of originating telephone number. If the originating telephone is a mobile 
telephone, then the entry in column 2 14 of table 200 may contain "mobile". The 
destination number is the telephone number of the mobile telephone to which the call was 
placed. The destination location can be determined by the MSC 1 10 determining which 

20 base station the mobile telephone was communicating with when the incoming call was 
received and looking up me location of that base station in an internal lookup table. 

The steps performed by the MSC 1 10 during mobile telephone call origination in 
accordance with the present invention arc shown in the flowchart of Fig. 3. During 
mobile telephone call origination, the mobile telephone 1 16 transmits its MIN / ESN pair 

25 along with the dialed telephone number to the MSC 1 10 via the BS 1 14 and air interface 
1 18. The MSC 1 10 receives the MIN / ESN pair and the dialed digits in step 302. In step 
304 the MSC 1 1 0 performs a database lookup to CDR DB 126 using the MIN / ESN pan- 
to retrieve the last call record from the CDR table 200. In step 306 it is determined 
whether the CDR record retrieved in step. 304 is null. This would be the case, for 

30 example, when a new telephone Is activated because there is no last call information. If 
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the data is null, then control passes to step 316, discussed below. If the data is not null, 
then in step 308 the MSC 1 10 sends last call details to the mobile telephone 1 16 via BS 
1 14 and air interface 1 1 8. 

The information sent to the mobile telephone includes some, or all, of the 

5 information from the last call record retrieved from the CDR table 200. Preferably, 
enough information is sent to mobile telephone 1 16 so that the user may easily identify 
the last call the mobile telephone 1 16 was engaged in. With respect to the format of the 
message, there are various options. Preferably, the message takes the form of a text 
message that is sent to the mobile telephone 116 and displayed on a textual display on the 

10 mobile telephone. Such a text message may be a short message service (SMS) message 
as defined by the IS- 1 36 standard. Alternatively, the message may take the form of a 
voice message which is transmitted to the mobile telephone 1 16 over a voice channel In 
accordance with such an embodiment, the MSC 1 10 activates". the IVR unit 132 to 
generate an appropriate voice message based on the information retrieved from the CDR 

1 5 table 200 in step 304. 

Upon receipt of the message, the user of mobile telephone 116 will review the last 
call information. The message will ask the user to respond with an indication as to 
whether the last call information corresponds with the user's last use of mobile telephone 
1 1 6. The user's response is received in step 3 1 0 and evaluated in step 3 12, If the user 

20 responds with a "yes," then it indicates that no fraud was indicated and control is passed 
to step 316. If the user responds with a "no," then it indicates that possible fraud was 
detected and the MSC 1 10 takes appropriate action in step 314. Such action may include 
sending a message to a customer care center whereby the possible fraud can be 
investigated, tcrrrunaring all use on the mobile telephone's account, or any other action 

25 which the service provider deems appropriate in the situation. After the appropriate fraud 
action is performed control is passed to step 316. As represented by step 3 1 6, the MSC 
1 10 waits until the call has ended When the call ends, the details of the call are stored in 
the CDR DB in step 3 18. The method ends in step 320. 

There are other possibilities for user interaction with the system to indicate fraud. 

30 For example, the user can be asked to only respond if the last call information does not 
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correspond with the user's last use of mobile telephone 1 1 6, Since the majority of 
responses from the user will indicate no fraud, this alternative saves air interface 
resources. In this case, the test in step 312 will interpret no response as no fraud 
Indicated and will pass control to step 3 16. 
5 There are also various implementations for step 3 1 0 of receiving the user 

response. For example, the user may respond by pressing a key on the telephone keypad 
which would send a DTMF signal back to the MSC 1 10. Other types of responses 
include two way paging and voice. 

Those skilled in the art will recognize that there are many alternatives with respect 

10 to the message sent to the user, the format of such a message, the type of response 

requested of the user, and the format of such a response. In all of these alternatives, the 
basic notion is that the user is being supplied with information regarding the last use of 
the telephone and is being asked to identify possible fraud to the network. 

The steps performed by the MSC 1 10 during mobile telephone call termination 

1 S (i.e. incoming call) in accordance with the present invention are shown in the flowchart of 
Fig. 4. In this situation, the mobile telephone 1 16 is die recipient of a telephone call 
placed by some other telephone. In step 402, the MSC 1 10 receives a call which is 
placed to mobile telephone 1 16. For example, the call may be one placed from a landline 
telephone and received from the PSTN 120. The receipt of such a call will include the 

20 MIN of the mobile telephone 1 1 6. Since the mobile telephone 1 1 6 is registered with the 
wireless network, the MSC 1 10 will have already determined the ESN of die mobile 
telephone. At this point the MSC has the ESN / MIN pair for mobile telephone 1 16. 
Steps 406 through 422 are performed la the same manner as corresponding steps 304-320 
discussed above in conjunction with Fig. 3. 

25 It is noted that the flowcharts of Figs. 3 and 4 show only those steps performed by 

the MSC 1 10 that related to the present invention. MSC 1 10 will also perform other 
steps related to call processing with respect to mobile telephone call origination and call 
termination. Such other steps include the steps necessary to set up and manage a wireless 
telephone call and are well known and will not be described further herein. The steps of 

30 Figs. 3 and 4 may be performed by the MSC before, during, or after such other steps. 
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The flowcharts of Figs. 3 and 4 show the steps of an embodiment in which the 
message is seat to the telephone (steps 308 and 410) prior to the voice call being set up, 
Sucb an embodiment assumes that a user response will be received (steps 3 10 and 412) 
prior to the end of the call, which is checked for in steps 3 1 6 and 418, Such an 
5 implementation is useful where the message sent to the telephone is in the form of a text 
message sent to a display of the telephone. In such a case, the user could review the text 
message and respond fairly quickly, thus only delaying the telephone call for several 
seconds. Of course, other embodiments are possible. If the message sent to the telephone 
is in the format of a voice message it may be impractical to send such a message prior to 

1 0 the telephone call because of the longer delay involved. In such a case, the steps of the 
method could be rearranged such that the message is sent, and the reply received, after the 
call has terminated. In yet another possibility, the message could be sent to the telephone 
prior to the telephone call being set up, but a response from the user of the telephone call 
could be received after, or even during, the telephone call. Thus, one skilled in the art 

15 could rearrange the order of the steps of the methods shown in Figs. 3 and 4 end still fall 
within the contemplated scope of the invention. 

Figs. 5-8 show exemplary contents of the CDR table 200 in conjunction with an 
example of how fraud may be detected in conjunction with the aspects of the present 
invention. .Consider a new telephone subscriber who activates a mobile telephone with a 

20 MIN of 206-123-4567 and an ESN of 82ahcl23. Prior to use, a CDR record 502 would 
be as .shown in Fig. 5. The MIN and ESN fields, 202 and 204 respectively, contain the 
MIN / ESN pair of the mobile telephone. The reniaining fields 206-220, are null, because 
there is no last call information to store. Assume that at 7:58am on May 1, 1997 the 
subscriber places a legitimate call to telephone number 202-876-5432 in Washington 

25 D.C. In accordance with the mobile telephone call origination steps of Fig. 3, in step 302 
the MSC would receive the MIN / ESN pair of the mobile telephone and the dialed digits. 
In step 304 the MSC 1 10 performs a CDR DB 126 lookup. Since this is the first call 
placed by a newly activated telephone, the CDR record 502 contains null information and 
the test in step 306 causes control to pass to step 3 16. The MSC 1 10 waits for the call to 

30 end. Assume that the call ends at 8:00am. At that time, in accordance with step 3 18, a 
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CDR record 602, which replaces CDR record 502, is created in the CDR DB 126 as 
shown in Fig. 6. The method ends at step 320, 

Assume now thai at 10:38am a fraudulent call is placed using me legitimate MIN 
/ESN pairofMIN=206-123-4567andESN=82abc!23. This call is placed to telephone 

5 number 819-555-3333 in Bogota, Columbia. Returning to the steps of Fig. 3, the MSC 

1 10 receives the MIN / ESN pair and the dialed digits in step 302. In step 304 the MSC 
1 10 performs a CDR DB 126 lookup and retrieves record 602 from the CDR DB 126. 
The test of step 306 indicates mat the data is not null and in step 308 a message 
containing the call detail information from record 602 is sent to the fraudulent mobile 

10 telephone. Presumably, the person making the fraudulent telephone call wiU respond to 
the message indicating that the call detail information does not indicate possible fraud. 
The MSC 110 receives the user response in step 3 1 0 and in step 3 1 2 control is passed to 
step 316 where the MSC 1 10 waits for the call to terminate. Assuming the call terminates 
at 10:49am, control will pass to step 318 and a CDR record 702, which replaces CDR 

1 5 record 602, is created in the CDR DB 126 as shown in Fig. 7. The method ends at step 
320. 

Assume now that an incoming call is received at the legitimate mobile telephone 
at 11:10am on May 1, 1997 from telephone number 214*123-2323 in Dallas, Texas. At 
the time the call is placed, the CDR table 200 contains'record 702 which has the call 

20 details of the fraudulent call. In accordance with the steps of Fig. 4, the MSC 1 10 

receives the incoming call at step 402 and determines the ESN of the mobile telephone in 
step 404. In step 406 the MSC 1 10 performs-a CDR DB 126 lookup and retrieves record 
702 from the CDR DB 126. The test of step 408 indicates that the data is not null and In 
step 410 a message containing the call detail information from record 702 is sent to the 

25 legitimate mobile telephone. The legitimate user will notice that the call details do not 
correspond to the last legitimate use of the mobile telephone and will respond 
accordingly. The MSC 1 10 receives the user response in step 412 and in step 414 control 
is passed to step 4 1 6 where the MSC 1 1 0 takes appropriate fraud action. Control passes 
to step 41 8 and the MSC 1 10 waits for the call to tenninate. Assuming the call 

30 terminates at 1 1 : 1 lam, control will pass to step 420 and a CDR record 802, which 
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replaces CDR record 702, is created in the CDR DB 126 as shown in Fig. 8. The method 
ends at step 422. 

The foregoing Detailed Description is to be understood as being in every 
respect illustrative and exemplary, but not restrictive, and the scope of the invention 
5 disclosed herein is not to be determined from the Detailed Description, but rather from 
the claims as interpreted according to the full breadth permitted by the patent laws. It is to 
be understood that the embodiments shown and described herein are only illustrative of 
the principles of the present invention and that various modifications may be 
implemented by those skilled in the art without departing from the scope and spirit of the 
10 invention. For example, the above description described an embodiment in which a 
message containing prior call data is sent to the telephone the next time the telephone 
engages in a telephone calL In another embodiment, prior call data may be sent to a 
telephone .when the telephone is powered on and registers with the system, 
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We claim: 

1 LA method for delecting fraud on a wireless subscriber account comprising 

2 the steps of: 

3 storing data identifying a first wireless system access using said subscriber 

4 account; 

5 transmitting said data to a wireless device during a second wireless system 

6 access using said subscriber account. 

1 2. The method of claim 1 further comprising the step of: 

2 receiving from said wireless device a response indicative of whether said first 

3 wireless system access is authorized. 

1 3, The method of claim 1 or 2 wherein: 

2 said first wireless system access is a telephone call; and 
3 . said second wireless system access is a telephone caU. 
4 

1 4. The method of claim 1 or 2 wherein: 

2 said first wireless system access is a telephone call; and 

3 said second wireless system access is wireless system registration. 

4 * 



\ 



5. The method of claim I or 2 wherein said step of transmitting further 



2 . comprises the step of transmitting a text message to said wireless device. 

1 6. The method of claim 5 wherein said step of transmitting further comprises 

2 the step of transmitting said text message via short message service. 
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1' 7. The method of claim 1 or 2 wherein said step of transmitting further 

2 comprises the step of transmitting a voice message to said wireless device. 

1 8. A method for detecting fraud on a wireless subscriber account comprising 

2 the steps, in the sequence set forth, cf: 

3 receiving a first service request including subscriber account information from 

4 a first wireless device; 

5 storing data identifying said first service request in a database; 

6 receiving a second service request including said subscriber account 

7 information from a second wireless device; 

8 retrieving from said database said data identifying said first service request; 

9 and 

10 transmitting at least a portion of said data identifying said first service request 

1 1 to said second wireless device, 

1 9. The method of claim 8 further comprising the step of: 

2 receiving a response from said second wireless device indicative of whether 

3 said first service request was fraudulent. 

1 10. The method of claim .8 or 9 wherein said first and second wireless devices 

2 are the same device. 

1 1 1. The method of claim 8 or 9 wherein said first and second wireless devices 

2 are different devices. 

1 , 12. A method for detecting fraud on a wireless telephone subscriber account 

2 comprising the steps of: 

3 storing call detail data identifying a first telephone call associated with said 

4 subscriber account; 
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5 subsequent to said first telephone call, transmitting at least a portion of said call 

6 detail data to a wireless device in response to a second telephone call associated with said 

7 subscriber account. 

1 13. The method of claim 12 further comprising the step of: 

2 receiving from said wireless device a response indicative of whether said first 

3 telephone call is authorized. 



i 
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